Use-After-Scope Vulnerability in OpenImageIO Affecting Various Image File Formats

CVE-2026-65970

What is CVE-2026-65970?

OpenImageIO, a toolset essential for reading, writing, and manipulating various image file formats, is vulnerable to a use-after-scope issue. This vulnerability arises when processing a specially crafted ZIP-compressed TIFF file with multithreading enabled. The problem occurs in the TIFFInput::read_native_scanlines() function, where queued asynchronous strip-decompression work can potentially access stale stack and heap storage due to premature destruction of captured objects. This mismanagement can lead to a crash and denial of service. Users are encouraged to update to version 3.1.16.0, as this release includes crucial fixes addressing the vulnerability.

References